TENDRIL sell hook drains USDT liquidity from its PancakeSwap V2 pool
Researchers traced a sell-hook exploit in TENDRIL on BNB Chain. The affected PancakeSwap V2 pair lost about 555,671 USDT net in one transaction. An attributed beneficiary received about 308,959 USDT in the transaction. Those amounts measure different flows. A project fix or restitution remains unverified.
- Disclosed
- Nov 5, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- The affected TENDRIL/USDT PancakeSwap V2 pool on BNB Chain. An ordinary seller could trigger the vulnerable hook.
- TENDRIL · BNB Chain · DeFi · PancakeSwap
- In the wild
- Yes
- ExVul, CertiK and BlockintAI identify the same executed pool-drain transaction.
What happened
TENDRIL’s sell hook let an unprivileged seller trigger a controller to burn TENDRIL held by the pair and synchronize the lower reserve before the rest of the seller’s tokens arrived. The distorted reserves let the subsequent swap take nearly all of the pool’s USDT. The reported defect is in the token’s custom sell logic. The evidence concerns this pair on BNB Chain.
ExVul reports roughly 550,000 USDT in pool losses and CertiK estimates roughly $555,000 in net loss. TenArmor’s initial alert estimated about $309,000 in losses without publishing its calculation. BlockintAI measures about 555,671 USDT net out of the pair and about 308,959 USDT transferred to the attributed beneficiary in the same transaction. The beneficiary transfer alone does not establish final attacker profit. No project-confirmed final loss, replacement contract or compensation was established in the reviewed disclosures. Public copies are available for the ExVul alert, CertiK alert and TenArmor alert.
Crime-scene timeline
Nov 4, 16:02 UTC
A sale burns tokens from the pair before its swap
The exploit transaction synchronizes the depleted TENDRIL reserve before the remaining sell input arrives and removes almost all of the pool’s USDT.
Nov 5, 05:58 UTC
ExVul publishes a sell-hook analysis
ExVul identifies the affected pair and token, the transaction and addresses associated with the exploit.
Nov 5, 2026
Other researchers separate pool outflow from beneficiary receipts
CertiK estimates about $555,000 in net losses. BlockintAI measures about 555,671 USDT net out of the pool and about 308,959 USDT sent to the attributed beneficiary.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- ExVul original exploit alertPrimaryOriginal alert read in a public copy. Identifies the ordinary-sell trigger, reserve update and role-labelled addresses.
- CertiK original exploit alertPrimaryOriginal alert read in a public copy. Identifies the sell-hook path and estimates about $555,000 in net losses.
- BlockintAI transaction and balance analysisPrimaryIndependently reads the transaction and reports the pool’s net USDT outflow, beneficiary receipt, timing and funding context.
- TenArmor initial alertPrimaryOriginal alert read in a public copy. Initially estimated a loss of about $309,000 for the same transaction.